AI chatbot and the AI Act: what you need to know from 2 August 2026

If an AI-based chat runs on your website, then since 2 August 2026 a new rule has applied to you: customers must know that they are talking to a machine. It is one of the simpler obligations in the EU regulation on artificial intelligence (the AI Act), but it is easy to do carelessly. Below I explain what the rule says, what to remember about personal data and how much it costs to adapt a chat.

I am not a lawyer. This is a practical summary from the perspective of someone who implements chatbots. For unusual uses, e.g. in medicine, finance or recruitment, consult a lawyer.

The AI Act in brief: what applies from when

The AI Act is Regulation (EU) 2024/1689. It applies directly in all EU countries. It entered into force on 1 August 2024, and its provisions start applying in stages:

• 2 February 2025: prohibited practices, e.g. social scoring or manipulation that exploits people’s vulnerabilities.
• 2 August 2025: obligations of providers of general-purpose AI models, that is, the ones that popular chats run on.
• 2 August 2026: most of the remaining provisions, including the transparency obligations in Article 50, which concern chatbots.

Some deadlines were the subject of proposed changes in 2025–2026 as part of the so-called Digital Omnibus package, mainly regarding high-risk systems. Before you implement anything, it is worth checking the current state of the rules. Telling customers that they are talking to AI is, however, the easiest thing to implement, so there is no point in putting it off.

Penalties are imposed by national authorities. For breaching the obligations under Article 50, the AI Act provides fines of up to €15 million or up to 3% of annual worldwide turnover. As a rule, the higher of these amounts counts, and for small and medium-sized businesses the lower.

What exactly Article 50 says

The chatbot must introduce itself

AI systems intended to interact directly with people must be designed so that the person knows they are talking to AI (Article 50(1)). The exception applies where this is obvious to a reasonably well-informed, observant user. I wouldn’t rely on that exception: a robot icon next to the chat window is not obvious to everyone.

The information must be clear and distinct, given at the latest at the first interaction, and must meet accessibility requirements (Article 50(5)). In practice, a screen reader should read it out too.

Who is responsible for the disclosure

The obligation under paragraph 1 rests on the provider of the AI system. Under the definition in Article 3, a provider is also a company that commissions the development of a system and puts it into service under its own name or trademark. If the chat runs on your website under your brand, assume that this obligation applies to you, even if an OpenAI, Google or Anthropic model works underneath.

The same applies to bots on Messenger, Instagram or WhatsApp. If AI replies there, the customer also has to know about it.

AI-generated content

Article 50(2) obliges providers of systems that generate images, audio, video and text to mark the outputs in a machine-readable format. This applies chiefly to the creators of models and generators, and the details are to be clarified by guidelines and a code of practice being prepared by the European Commission.

Companies that use such tools (the AI Act calls them deployers) are covered by Article 50(4):

• you must disclose that an image, recording or video is a deepfake, that is, realistic AI content that a viewer could take for real,
• you must disclose that a text was created with the help of AI if you publish it to inform the public about matters of public interest, unless a human has edited it and someone bears editorial responsibility for it.

In practice, a product description written with the help of AI and checked by you does not need an AI Act label. An AI visualization of a terrace that looks like a photo of a finished project is better labeled as a visualization. That is fair to the customer and protects you from a charge of misleading.

GDPR: what is easy to forget

The AI Act is one thing, but a chat also collects personal data: name, email, phone, the address of a building site, and sometimes information the customer shouldn’t be entering at all. Check a few things:

• Privacy policy. Describe the chat in it: what data it collects, for what purpose, how long you keep conversations and who the recipients of the data are, e.g. the AI model provider.
• Data processing agreement. With the model provider and the hosting you need a data processing agreement (DPA).
• Place of processing. If data goes outside the European Economic Area, you need a basis for the transfer, e.g. a European Commission decision finding an adequate level of data protection, or standard contractual clauses.
• Model training. Check in the provider’s terms whether conversations can be used to train models. On paid API plans this is usually switched off; on free ones it varies.
• Minimization. The chat shouldn’t ask for data it doesn’t need. Don’t upload internal documents or customer data to its knowledge base if you don’t want to show them to the world.
• Retention period. Decide after how long conversations are deleted.

If you want to keep conversations and customer data on a separate server in the European Union, that is a separate service from PLN 1,990 plus the cost of the server.

Checklist: an AI Act-compliant chatbot

1. The chat’s first message says outright that it is an AI assistant. For example: “Hi, I’m the AI assistant of company X. I may make mistakes, so for important matters I will connect you with a human.”
2. The AI notice is also visible in the header of the chat window, not only in the first message, which can be scrolled away.
3. The notice is accessible: a screen reader will read it out, and the text has sufficient contrast.
4. When a customer asks “are you a human?”, the chat answers truthfully.
5. The chat doesn’t impersonate a specific employee, e.g. with the name and photo of a real person.
6. The customer can easily reach a human: phone, email or a form.
7. The chat has a clearly defined list of things it must not promise: discounts, deadlines or prices outside the price list.
8. The privacy policy describes the chat, and you have a data processing agreement with the provider.
9. Conversations have a set retention period.
10. AI content on the website that could be misleading, such as realistic visualizations or video with generated people, is labeled.
11. Someone in the company regularly reads the conversations and improves the chat’s knowledge.

Items 1 and 3 follow directly from Article 50, and item 10 when the content is a deepfake. The rest are good practices that help avoid misunderstandings with customers.

How much a chatbot and AI Act compliance cost

On the market, implementing a chatbot usually costs PLN 3,000 to PLN 15,000, and a subscription for a simple chat is about PLN 200–500 per month. The monthly fee exists because every conversation costs money: the AI model provider bills for usage, and the chat has to run on a server.

I implemented an AI chat on the websites of Łazienki Giżycko and Drzwi Giżycko, among others. The assistant on my website says it is AI from the very first message.

I will check your chat

Already have a chatbot and don’t know whether it meets the requirements? Or do you want to implement a new one that is AI Act-compliant from day one? Write to me through the form. I will reply with a quote within 24 hours, and new clients get 20% off their first project.